@sproutboat/toolchain 0.3.2 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @sproutboat/toolchain
 
+## 0.4.0
+
+### Minor Changes
+
+- 69bfe69: Vendor the pinned Porffor commit tarball (`packages/toolchain/vendor/`) so `ensurePorffor()` needs no network on the happy path — same pattern as sproutboat-cli's vendored uWebSockets archive. Falls back to the existing checksummed download if the file is missing, or was left stale by a pin bump that forgot to re-vendor.
+  
+  Part of sproutboat-cli #134 item 3.
+
 ## 0.3.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/acquire.test.ts

@@ -150,6 +150,18 @@ test("integrity failures stop acquisition and publish no cache entry", async ()
   expect((await readdir(cacheRoot)).some((name) => name.startsWith("porffor-"))).toBe(false);
 });
 
+test("the default call (no url/expectedSha256 override) never touches the network", async () => {
+  const cacheRoot = await mkdtemp(join(tmpdir(), "sb-porffor-vendored-"));
+  temporary.push(cacheRoot);
+  const dir = await ensurePorffor({
+    cacheRoot,
+    fetcher: async () => {
+      throw new Error("the vendored archive must be used before any network fetch");
+    },
+  });
+  expect(await readFile(join(dir, "runtime/index.js"), "utf8")).not.toBe("");
+});
+
 test("a corrupted warm cache is replaced from the verified archive", async () => {
   const { archive, sha256 } = await fixture();
   const cacheRoot = await mkdtemp(join(tmpdir(), "sb-porffor-corrupt-"));

package/src/acquire.ts

@@ -3,6 +3,9 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
+// @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
+// check below for why this is safe to trust unconditionally.
+import vendoredPorfforArchive from "../vendor/porffor-1f4ae4a.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 
@@ -130,7 +133,15 @@ export async function ensurePorffor(options: AcquireOptions = {}): Promise<strin
     await rm(dir, { recursive: true, force: true });
     await mkdir(stage);
     const archive = resolve(stage, "source.tar.gz");
-    await download(options.url ?? PORFFOR_ARCHIVE_URL, archive, options.fetcher ?? fetch, options.timeoutMs ?? 30_000);
+    // The commit tarball ships in the package (`vendor/`), same pattern as
+    // sproutboat-cli's vendored uWebSockets archive: no network needed on the
+    // happy path. Falls back to downloading it if the file is missing or was
+    // left stale by a pin bump (checksum below still catches a wrong file
+    // rather than silently accepting it).
+    const noOverride = options.url === undefined && options.expectedSha256 === undefined;
+    const vendored = noOverride && existsSync(vendoredPorfforArchive) && (await digest(vendoredPorfforArchive)) === expected;
+    if (vendored) await writeFile(archive, await readFile(vendoredPorfforArchive));
+    else await download(options.url ?? PORFFOR_ARCHIVE_URL, archive, options.fetcher ?? fetch, options.timeoutMs ?? 30_000);
     const actual = await digest(archive);
     if (actual !== expected)
       throw new PorfforToolchainError(